Privacy by Design for the Internet of Things: Building accountability and security

Description

Privacy by design is a proactive approach that promotes privacy and data protection compliance throughout project lifecycles when storing or accessing personal data. Privacy by design is essential for the Internet of Things (IoT) as privacy concerns and accountability are being raised in an increasingly connected world. What becomes of data generated, collected or processed by the IoT is clearly an important question for all involved in the development, manufacturing, applications and use of related technologies. But this IoT concept does not work well with the 'big data' trend of aggregating pools of data for new applications. Developers need to address privacy and security issues and legislative requirements at the design stage, and not as an afterthought. In this edited book, the authors draw on a wealth of interdisciplinary research to delineate the challenges of building accountability into the Internet of Things and solutions for delivering on this critical societal challenge. This advanced book brings together legal-tech scholars, computer scientists, human computer interaction researchers and designers and socials scientists to address these challenges and elaborate solutions. It articulates the accountability principle in law and how it impacts IoT development, presents empirical studies of accountability in action and its implications for IoT development, brings technological responses to the requirements of GDPR and ways of building accountability into the IoT, and covers compliant IoT application development, privacy-preserving data analytics, human-centred IoT security, human-data interaction, and the methodological challenge of understanding and responding to the adoption of future technologies in everyday life. Halftitle Page Series Page Title Page Copyright Contents List of figures List of tables About the editors 1   Privacy by design for the Internet of Things 1.1   The Internet Data of Things 1.2   Human data interaction 1.2.1   Fundamental challenges 1.2.2   Associated challenges 1.2.3   Summary 1.3   Contribution of collected works to HDI 1.4   Acknowledgements References 2   On the principle of accountability: Challenges for smart homes and cybersecurity 2.1   Introduction 2.2   The principle of accountability 2.2.1   Trajectory from the OECD 1980 to GDPR 2016 2.2.2   Article 5(2) GDPR and the obligations it creates for data controllers 2.2.3   Accountable to whom? 2.2.4   What form demonstrations of accountability might take? 2.3   DP in the home? 2.3.1   The household exemption and its (in)applicability to domestic IoT 2.3.2   Domestic and non-domestic joint controllership in domestic IoT 2.3.3   Accountability shared between domestic and non-domestic controllers 2.4   Accountable DDCs 2.4.1   Smart home cybersecurity management tools 2.4.2   Security (and privacy) management in smart homes 2.4.3   Interpersonal power dynamics in smart homes 2.4.4   Control struggles in smart homes 2.4.5   Towards collective security management in homes? 2.4.6   Differentiated responsibilities 2.5   Conclusion 2.6   Acknowledgements References 3   Accountability in ordinary action 3.1   Introduction 3.2   The naturally accountable organisation of digital privacy in the home 3.2.1   Privacy as accountability management 3.2.2   Breaching privacy 3.3   Discussion 3.4   Conclusion 3.5   Acknowledgements References 4   The socially negotiated management of personal data in everyday life Abstract 4.1   Introduction 4.2   The cardboard box study 4.2.1   Findings 4.3   Discussion 4.3.1   The impact of the IoT on everyday life 4.3.2   Designing for the collaborative management of privacy 4.3.3   Respecting mutual dependence 4.4   Conclusion 4.5   Acknowledgements References 5   Towards an accountable Internet of Things: A call for reviewability 5.1   Introduction 5.1.1   Accountability 5.2   The need for reviewability 5.2.1   Challenges to accountability in socio-technical ecosystems 5.2.2   Reviewability 5.3   The legal dimension 5.3.1   Compliance and obligation management 5.3.2   Regulatory oversight and audit 5.3.3   Liability and legal investigation 5.4   The broader benefits of systems review 5.4.1   Building, operating and managing systems 5.4.2   Facilitating oversight activities 5.4.3   Better informing users 5.5   Technical mechanisms for supporting reviewability 5.5.1   Decision provenance: Exposing the decision pipelines 5.5.2   Technical challenges 5.6   Reviewability in practice: A smart city A traffic incident What role did the driver play? Why were the street lights dimmed? Why was the ambulance delayed? Putting together what happened 5.7   Concluding remarks 5.8   Acknowledgements References 6   Building accountability into the Internet of Things 6.1   Introduction 6.2   The external accountability requirement 6.3   Implementing the external accountability requirement 6.4   Accountability at the edge: The IoT Databox model 6.4.1   Origin and evolution of the model 6.4.2   Architecture of the model 6.4.3   App development 6.4.4   Managing risk 6.4.5   Enabling consent and granular choice 6.5   Responding to the privacy challenge 6.6   Fit with the state-of-the art 6.7   Conclusion Acknowledgements References 7   Data protection by design and default: IoT app development Abstract 7.1   Introduction 7.2   Background 7.2.1   Legal frameworks Data protection by design and default (DPbD) Data protection impact assessment (DPIA) 7.2.2   Documentation Frameworks Ideation cards 7.2.3   Bridging between tools and design Policies and ontologies Design patterns 7.2.4   Privacy tools Automated program analysis APIs and services 7.3   Designing for due diligence 7.4   Embedding support for due diligence in design 7.4.1   Tracking personal data 7.4.2   Developing a categorisation 7.5   Implementation and overview of the IDE 7.5.1   Using the IDE 7.5.2   Providing DPIA recommendations 7.6   Enabling due diligence 7.7   Conclusion 7.8   Acknowledgements References 8   Distributed data analytics 8.1   Why distribute analytics? 8.2   Approaches to distribution 8.2.1   Distributed analytics 8.2.2   Federated and hybrid learning 8.2.3   Personalised learning 8.2.4   Securing data 8.3   Analytics at the edge 8.4   Databox, a platform for edge analytics 8.4.1   Subject-driven 8.4.2   Processor-driven 8.5   Personalised learning at the edge 8.5.1   Privacy attacks 8.5.2   Poisoning attacks 8.6   Extreme scaling at the edge 8.6.1   Bounded synchronous parallel (BSP) 8.6.2   Asynchronous parallel (ASP) 8.6.3   Stale synchronous parallel (SSP) 8.6.4   Probabilistic synchronous parallel (PSP) 8.7   Conclusion 8.8   Acknowledgements References 9   Human-­centred home network security 9.1   Introduction 9.2   Networking background 9.2.1   Network mechanisms 9.3   Shaping user interaction 9.3.1   Designing for control 9.4   Compliance by design 9.4.1   Outlining the regulatory framework with academic research 9.4.2   Extracting practical insights from industrial involvement 9.4.3   Shaping the prospect by informing policymaking 9.4.4   Lessons of DADA on compliance by design 9.5   Acknowledgement References 10   Anticipating the adoption of IoT in everyday life 10.1   Adoption 10.2   Technology futures 10.3   Design fiction as worldbuilding 10.4   Case studies 10.4.1   Game of drones 10.4.1.1   Addressing the legality of drones 10.4.1.2   Considering the required Infrastructure 10.4.1.3   The devil is in the detail 10.4.1.4   Reflections 10.4.2   Allspark 10.4.2.1   Reflections 10.4.3   Living Room of the Future 10.4.3.1   Physical objects 10.4.3.2   Media objects 10.4.3.3   Data objects 10.4.3.4   What about privacy? 10.4.3.5   The experiential future Introduction Personalised media experience Reveal 10.4.3.6   Reflections 10.5   Conclusions 10.6   Acknowledgements References Index Back Cover